Skip to content
OpenAdvisories
High ALAS2-2026-4033 1 CVE

Important: python3-tornado security update (Amazon Linux 2)

Published Oct 26, 2026 · Updated Oct 26, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-103262: Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions.

Fixed packages 3

ReleasePackageFixed in
Amazon Linux · 2 python3-tornado 0:5.0.2-4.amzn2.0.12
Amazon Linux · 2 python3-tornado-debuginfo 0:5.0.2-4.amzn2.0.12
Amazon Linux · 2 python3-tornado-doc 0:5.0.2-4.amzn2.0.12

Vulnerabilities 1

  • High 7.5
    CVE-2026-103262

    Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient

    Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that acc…

    tornadoweb tornado python-tornado python-tornado Debian Ubuntu Azure Linux PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-103262.html